Method for anonymous computerized processing of documents or objects

ABSTRACT

The invention concerns a method comprising: a) associating with or incorporating ( 1716 ) in the physical element a single information medium, including: i) an author section bearing a first predetermined code, ii) at least an administration section bearing a second predetermined code; b) permanently associating an identification of the author with the author section ( 1717 ); c) separating the author section from the physical element with each administration section ( 1740 ); d) processing the material element ( 1775 ) of the separated author section to supply at least a processing result; e) scanning the author section ( 1783 ) to read and associate the first code with the author identification; f) scanning at least an administration section ( 1784 ), to read and associate the second code with at least a processing result; and g) matching ( 1785 ), via codes, at least a processing result with the author identification.

The present invention relates to a process and a form for anonymousprocessing of a material element, a machine and a label to use them inparticular modes. It is applicable particularly to the processing ofexamination sheets so that the score will not be influenced by knowledgeof the identity of their author.

The problem of keeping anonymous documents or physical data pertainingto a person or an institution or any element having connection with anidentification, relates to numerous activities: examinations,recruitment competitions, investigations of different types,particularly medical, tests of all types. These activities often involveconflicts of interest or the respecting of private life. To deal withour technical solution, we will give an example in the case ofexaminations of the educational type, but in all cases requiring them,during an intermediate phase, the anonymous processing of sensitivedata, the principles and the techniques are identical.

The problem with which are confronted institutions, universities, publicor private establishments, administering examinations or competition, isto ensure the candidates an anonymity guaranteeing them impartiality oftheir grading.

The problem is twofold:

1) It is necessary that the corrector can in no case recognize acandidate by reason of the identification of the copy provided by themanaging organism (we don't have the aim of preventing recognition ofthe handwriting by the corrector, this is a different and marginalproblem): in case of a corrector being able to disfavor a candidate.

2) It is not necessary that the candidate be able to transmitidentification elements of his copy to the corrector: the case of acorrector being able to favor a candidate.

The present processes used are all based on manual modalities:

-   -   foldable adhesive patch, hiding the handwritten identity of the        candidate,    -   double indexing a posteriori of the copies: a number on the        portion identified by the candidate, the same number on the copy        itself, with trimming of the identified portion,    -   assignment of an independent bar code, personal to each        candidate, to be stuck on the copy . . .

These processes are particularly difficult to use and encounter problemsof human management, both as to quantity and as to quality, as to themonitoring of the safety protocols of these processes, because theyrequire a considerable time whilst being easy to evade.

Moreover, these processes are additive to the difficult procedures ofsupervision and normal surveillance of an examination, and thus requirea great deal of responsible and well-qualified work that is hard tomatch to present standards, because they generate backups at certaintimes such that it is quite often impossible to follow the providedsafety procedures. Generally speaking, many people have or could easilyhave access, with these procedures, for a substantial period of time, toinformation on the data and have the possibility of influencing theresult.

These processes only vary imperfectly meet the problem of processing thecopies anonymously without permitting:

-   -   guaranteeing respect for its good execution,    -   managing more generally the tests, or    -   handling by computer the or above all several independent        results for a same data (double correction) for effective        control.

The present invention seeks to overcome these drawbacks.

To this end, the present invention seeks, according to a first aspect, aprocess for anonymous and computerized processing of a document orphysical element, hereafter called “physical element”, whose author orowner, hereafter called “author”, must remain unknown during processingof the physical element, this process being characterized in that itcomprises:

-   -   a step of association or integration with the physical element        of a unique information support, comprising:        -   an identification section of the author called “author”            section bearing a first predefined code,        -   at least one so-called “administration” section each            carrying a second predefined code identical to or different            from the first predefined code,        -   these sections forming a unique couple, the codes being            defined prior to the association or integration step,    -   a step of permanent association of an identification of the        author with the author section;    -   a step of separation of the author section and the physical        element, each administration step remaining attached or        integrated to the physical element;    -   a step of processing the physical element separated from the        author section, to provide at least one processing result of the        physical element;    -   a step of reading from the author section to read and associate        the first identification code of the author of the physical        element;    -   a step of reading at least one administration section, to read        and associate the second code with at least one processing        result of the physical element;    -   a step of matching by means of codes, at least one processing        result with the identification of the author of the physical        element, permitting ending the anonymity;        at least one of the reading steps comprising an optoelectronic        reading and recognition phase.

Thanks to these arrangements, all the author sections can be easilyisolated during the step of processing, for example a correction phaseof the tests, and the matching of the processing results and the authoridentifications is very rapid whilst being carried out by only a uniquededicated person.

According to particular characteristics, the first author code is uniqueand different from each second code, which is also unique.

Thanks to these arrangements, the risk of communication is decreased.

According to particular characteristics, the relationship between thefirst code and each second code is generated by an unpredictablecomputer algorithm which uses a random variable and in that the value ofsaid variable and/or a table for matching the codes, are memorized.

According to particular characteristics, the relationship between thefirst code and each second code is generated by an unpredictablecomputer algorithm which uses a variable representative of a type ofcontent of the physical element and in that the value of said variableand/or a table of correspondence of the codes, are memorized.

According to particular characteristics, at least one administrativesection constitutes the physical element.

According to particular characteristics, in the course of the processingstep, the information carried by the author on the administrationsection is processed and there is supplied at least one result in theform of at least one value or grade.

Thanks to each of these arrangements, a multiple choice questionnaire orany personal medical formulation can be processed in an anonymousmanner, integrated with the administration section.

According to particular characteristics, the unique information supportcomprises an identification stub comprising one of the codes, said stubremaining connected to the physical element permanently.

Thanks to these arrangements, even if all the sections, author andadministration, have been detached, there can be assured thetraceability of the test thanks to the permanent association of thestub, which carries one of the codes and of the physical element.

According to particular characteristics, the process as briefly setforth above comprises a step of inscribing at least one result of theprocessing step on at least one administration section and a step ofseparating at least one administration section from the physicalelement, before the step of reading said administration section.

Thanks to these arrangements, the corrector or correctors can render thegrades by providing administration sections which concern them, thesegrades being adapted to be read during the processing, reinforcing theinterest of our process by providing a double solution to the problemsof anonymity and of the reliable and automatic acquisition of thegrades.

According to particular characteristics, the process as briefly setforth above comprises a step of masking at least one of the codes atleast until the step of separating the author section.

Thanks to these arrangements, each masked code is protected against anydisclosure rendering totally impossible the knowledge of the identity ofthe author before the procedure of canceling anonymity.

According to particular characteristics, the unique information supportcomprises several detachable administration sections bearing the samesecond unique code and a supplemental code defining the number of thesection. Thanks to these arrangements, several correctors can correctsuccessively the physical element and without knowing the results givenby the other correctors, thereby rendering effective the principle ofdouble correction.

According to particular characteristics:

-   -   at least one of the codes is integrated into a grid of        alphanumeric values, comprising at least one alphanumeric symbol        per case, the elements of the code having a predetermined place        in the grid, and/or    -   at least one of the codes corresponds to graphical signs        integrated into a grid of graphical signs whose elements        corresponding to the code have a predetermined position in the        grill.

Thanks to each of these arrangements, the code is very difficult tocrack if the predetermined positions in the grid are not known, thisplace being able to depend on a special coding of a case.

According to a second aspect, the present invention provides a machinefor re-indexing the identified elements in a manner that is handwrittenor by codes, using the process such as briefly set forth above, whichcomprises:

-   -   a reading device by optoelectronic process, of a handwritten        identification or a code, carried by the physical element or on        the unique information support;    -   a computer device for registering the handwritten identification        and/or code read in a digital file and which associates in said        digital file an explicit and sequential index code adapted to be        visually read and interpreted;    -   a device for printing this index code;    -   a system of masking the handwritten identification and/or the        code read on each physical element,        such that each physical element is thus re-indexed in an        anonymous manner and adapted to be visually interpreted.

Thanks to these arrangements, even if a second code is known, thecorrespondence with the index code remains unknown and any trickery isimpossible.

According to a third aspect, the present invention provides a form foranonymous processing of a physical element, which comprises:

-   -   an author section associated with a first code and adapted to        receive an identification of the author of the physical element;    -   at least one second administration section associated with a        second code identical to or different from the first code;        these sections being connected to form a unique couple, the        codes being either identical and specific for each form, or        different and corresponding for each form in an unpredictable        manner, the form being adapted to be secured to the physical        element, the author section being provided to be detached from        the administration section, the administration section remaining        associated with the physical element. So as to be able to detach        the administration section to permit particular processing, a        stub system comprising a first or second code or a code        representative of these latter, is provided.

The particular characteristics and advantages of this form beingidentical to those of the process briefly set forth above, they will notbe repeated here.

The present invention provides, according to a fourth aspect, a labelfor masking code used in the process as briefly set forth above, or formforms such as briefly set forth above, this label being opaque andcomprising a pre-cutout of an internal zone which is detached andexposes at least one code previously printed on at least one of thesections.

Thanks to these arrangements, at least one of the codes used, accordingto the present invention, can be masked during a portion of theprocessing of the physical elements.

Other advantages, objects and characteristics of the invention willbecome apparent from the following description, given with respect tothe accompanying drawings, in which:

FIG. 1 is a form for inscribing a test,

FIG. 2 represents a list of presence used in an embodiment of theprocess according to the present invention,

FIG. 3 represents a form according to a particular embodiment of thepresent invention,

FIG. 4 represents an example of an author section of a form according toa particular embodiment of the present invention,

FIG. 5 represents an example of an author section of a form according toanother particular embodiment of the present invention,

FIG. 6 shows an example of an author section of a form according toanother particular embodiment of the present invention,

FIG. 7 shows an example of a list of notation according to a particularembodiment of the present invention,

FIG. 8 shows an example of a list of notation according to anotherparticular embodiment of the present invention,

FIG. 9 shows an example of an administrative section including a QCMform according to an embodiment of the present invention,

FIGS. 10 and 11 show coding systems used in the particular embodimentsof the present invention,

FIG. 12 shows a machine to be indexed according to an embodiment of thepresent invention,

FIG. 13 shows a detailed view of the machine shown in FIG. 12,

FIG. 14 shows another detailed view of the machine shown in FIGS. 12 and13,

FIG. 15 shows another detailed view of the machine shown in FIGS. 12 to14,

FIG. 16 shows graphical codes used in particular embodiments of thepresent invention,

FIGS. 17A and 17B show an organigram of a process according to aparticular embodiment of the present invention,

FIGS. 18 and 19 show types of labels according to a particularembodiment of the present invention.

Before describing these figures, there will be given below generalexplanations.

The process according to the present invention assembles, in a preferredembodiment, an assembly of modalities based on computer processing byscanner reading of handwritten data which, overall, considerably reducethe time necessary for the management of an examination whilst providingsecurity of anonymity which is impossible to evade. Thus, a uniqueperson suffices to have access to the key to the anonymity, this keybeing adapted to be different for each test, its use being instantaneousand adapted to be guaranteed by a safety deposit. The process accordingto the invention moreover has, according to certain modifications, thepossibility of manual processing for safety which avoids any question asto the reliability whilst permitting totally anonymous practice by allpersons even those unqualified in computer.

The process according to the present invention combines, in a preferredembodiment, the computerized reading by scanner:

-   -   handwriting and alphanumeric printing,    -   cases to be checked off, scales, standard 1610 barcodes or        specific 1620, 1630 barcodes,    -   of alphanumeric or graphical codes for optical reading that can        be read without apparatus, and/or    -   of 1640, 1650, 1650 codes set forth in French application No. 95        10 803, the disclosure of which is incorporated herein by        reference.

There will be given below a description of the process applied to themanagement of an examination in all its particular phases.

1) Writing of Examinations, Step 1700 in FIG. 17A

Each candidate is identified by his name, given name, birthday, address,identification number, in all or in part, these elements being adaptedto be acquired by computer, directly or from an existing base (forexample inscription at the university).

In particular embodiments, the present invention uses an individual formshown in FIG. 1 guaranteeing the juridic act of inscription. Thisindividual Form 100 comprising boxes for handwritten insertions 110,wording 120 and, once instructed, handwritten annotations (not shown),is read by scanner and defines each group of instructions per test. Theinscription with juridically reliable form can be associated with aninscription of the Internet or Intranet line giving to the candidate,thereafter, access to any information on the examination: time, room,modality, confirmation of validity of his inscription and possibleproblems.

From inscriptions thus defined per test, the examination service dividesthe candidates by examination center and by room, and establishes listsof presence 200, shown in FIG. 2, per center and per room, and thisautomatically, as a function of predetermined criteria: availability ofrooms, capacity of each room relative to the examination conditions.Then the particular embodiment shown in FIG. 2, the list of presence 200comprises a box 205 in which are inscribed the references of the exam,210 of the examination room, 211 the date, 212, and for each candidate,indications of numerical identification, names, given names and birthdate 220 in the form of printed characters and/or barcodes, a box 230 tocheck off to indicate the presence of the candidate, a box to check off231 to indicate the absence of the candidate and a signature box 232.

The list of presence 230 serves to call the roll of those present and asthe case may be, the signature list. This list is provided to be readautomatically so as to establish the effective presence of theinscriptions, step 1710. So as to facilitate their reading, the data(name, given name, . . . ) can be present in the form of explicitstandard barcodes (not shown) of type 1600, 1610 or explicit codes oftype 1630, as shown in FIG. 16.

2) The Anonymity Form So as to avoid any individual preparation of thecopies or of labels generating numerous difficulties and the requirementfor measuring safety and security that is always haphazard, the uniqueinformation support or “form” 300 shown in FIG. 3, according to thepresent invention, is joint or integral with the copies, this form isindependent of the candidates and can thus be distributed to no matterwhich candidate, step 1715.

The process according to the present invention has two variants:

-   -   a—the use of a form 300 independent from the copy and then        associated (for example stapled or glued), step 1716, by its        stub 330 to the copy of a candidate with one or desired several        detachable sections called “administration” 320 a, 320 b, and a        detachable section called “author” 310, comprising as the case        may be a portion to be kept by the candidate 340.    -   b—the integration of the copy into the unique information        support or “form” 900 shown in FIG. 9, with one or if desired        two detachable sections called “administration” 920, a        detachable section called “author” 910, as the case may be a        portion to be kept by the candidate (not shown), and a zone        adapted to be filled in by the candidate in the course of the        test (questionnaire, multiple choice questionnaire, free        writing, for example). This zone is in the embodiment shown in        FIG. 9, included in the administration section 920.

The forms 300 comprise:

-   -   the author section 310, comprising a so-called “first” code 315        or “code A”,    -   one or several administration sections 320A, 320B (for the case        of double or multiple corrections), comprising a code 325A,        325B, called “second” code or “code B” belonging to each        administration section, integrated with the copy, or connected        to a stub 330,    -   if desired, the portion 340 to be kept by the candidate, bearing        the first code.

In the embodiment shown in FIG. 3, the first code is a code in standardalphanumeric format, simple and readable. This identification of theauthor section is unique, and will not be given twice in the frameworkof the same examination.

Each section of the Form 300 bears a code readable by scanner. Twomodifications of the process are proposed. They each rely on the use oftwo codes, A and B, of which the connection is impossible to establish(or unpredictable).

According to a first modification, the second code or codes are masked:this modification relies on:

-   -   a first simple alphanumeric code A, printed on the author        section,    -   a second simple alphanumeric code B, different from the first        code, printed on each administration section. This second code        is masked by serigraphy that can be scratched off with a layer        of security lacquer that can be colored or by any other masking        process of the type of labels 1800, 1900, FIGS. 18 and 19,        detachable once (not re-attachable, or not re-positionable),        such that any attempt to scratch off or unmask leads inevitably        to visual detection of the candidate's attempted fraud.

According to the second modification, the second code is not masked:This modification relies on:

-   -   A first simple alphanumeric code A, printed on the author        section, repeated as the case may be on the portion 340 to be        kept by the candidate,    -   A second unmasked code B but in the form of encrypted codes or        barcodes that are not explained, of the type 39, 128 or other        standards, or barcodes of the type of those of FIG. 16, 1620, to        be read by a scanner, imprinted on each section reserved for        administration and/or the corrector or correctors.

The general principle of the relationship between the first code and thesecond code is that, in the embodiment shown in FIG. 3, the first codeis for simple alphanumeric reading. This permits the easy management ofthe fresh documents before the test: storage, attribution per test, perroom and management of the test in the room. The numerals of this firstcode are followed, facilitating the use of the forms and theirnumbering. This code must not comprise possible duplicates within a sameadministration managing examinations, during a same session or for asame test.

This first code appearing only on the author section, its recognitiondoes not in any case permit knowing its relationship to a candidatebecause the latter is at random in the room.

During printing the first code, the second code is simultaneouslyprinted.

The second code is different from the first code and is associated withthe first code A according to a rule known only to the designer of thesoftware of the numbering system. This association is the product ofrandom selection that can be combined with an algorithm processing inthe series of numbers of the printed copies (a modification lesscomplicated can read by a unique algorithm treatment the codes A and B).

Thus, let it be supposed that we print 2000 copies beginning with No.1250081 and finish with No. 1252080, the correspondence by chance couldgive: CODE A CODE B 1 250 081 draws by lot 1 252 004 1 250 082 draws bylot 1 251 608 1 250 083 draws by lot 1 250 152 1 250 084 draws by lot 1251 493 1 250 085 draws by lot 1 250 741 . . .

The alphanumeric symbols, here digits of the second code, are maskedupon printing or indecipherable by direct reading. When the authorsections, bearing the first code, are detached from the Forms 300, theadministration and corrector sections become impossible to re-associatewith code A without having the corresponding computer file.

The copy being standard, any error or exceptional malfunction can beimmediately corrected by the distribution of another Form 300 or ofanother copy.

It will be understood that the characteristics of the present inventionguarantee inviolability of the correspondence of the codes by absence ofa connection between the first code and the second code. In numerouscases, it is possible to be satisfied with a system of correspondence bycoded algorithm that is more or less elaborate, kept secret, andaccessible only to the unique person responsible for anonymity. A simplesoftware protected by password serves in this case to “translate”between the first code and the second code. It is desirable that thecorrespondence algorithm be reserved for limited series of data to berendered anonymous and be different from series to series. Thispossibility of correspondence by an algorithm between the first code Aand the second code B defines a less complicated modification of ourprocess.

In particular embodiments, the first and second codes are identical. Inthis case, if no code is hidden, the corrector cannot know the code ofthe author because the author section comprising the handwrittenidentification of the author is detached, the only possibility for fraudbeing the communication by the author of his code to the corrector; ifthe second administration code is hidden, the corrector cannot know thecode of the author even if the author gives him his code, but anintervening administrator could establish the author-result relationshipbefore ending anonymity.

These various modalities thus constitute a particular embodiment of theprocess according to the present invention.

The examination takes place as follows:

Beginning of Examination, Step 1710

The monitors control, at the beginning of the test, the presence from alist of presence 200 by identifying in each case those present. Thislist can serve as a signature list thanks to a region 340 on thecandidate paragraph.

The monitors distribute the copies integrated into the forms accordingto the present invention or neutral copies and Forms 300, at thebeginning of the test, step 1715. The distribution might obviously takeplace in a different order from the order of the places and, ifpossible, randomly by variable lots. The candidates fill out the authorsection of which examples are shown in FIGS. 4 to 6 without filling inany other portions.

The examination takes place, step 1720. If a candidate has a defectiveor torn Form 300 or if he commits an error in filling it in, his Form300 is exchanged for another one.

End of Examination in the Room

At the end of examination, the candidates turn in their copies and theForms 300 which are stapled or glued to the assembly of copies turned inby each copy, step 1725.

The monitors count the copies, step 1730, and after being satisfied ofthe correspondence between the number present and the number of copies,step 1735, they proceed in two stages:

-   -   in the course of step 1740, the monitors detach the author        sections (FIGS. 4, 5, 6) by tearing off or cutting, thanks to a        system of micro-perforations, then, after counting the number of        author sections, the latter are sealed in a special “author        section” envelope, step 1750, with identification of the lot:        test, date, hour, number of forms from number X to number Y. The        forms 300 or the copies containing the author section that are        not distributed or exchanged, are separated and returned to the        administration and are voided, step 1755.    -   if the second code is masked, the administration proceeds then        to scratching off the serigraphy, by means of a scratch with a        razor blade, or peeling off the maskings, step 1715, FIG. 17B,        operations which take less than two seconds per copy.

FIG. 18 shows the case of masking labels 1800 adapted to mask two codes1820 and 1840 and to permit automatic unmasking during separation of twosections or a section from a stub 1850 and 1860 along a tear-off line1840.

FIG. 19 shows the case of a masking label 1900, 1940 adapted for maskingone or several codes located in a same section, a non-adhesive portioncan be easily torn off, 1910, by unmasking the code or codes 1950.

The copies are distributed by the administration to the corrector orcorrectors, step 1770 (the operation of unmasking can be carried out bythe correctors or by the administration after notation).

So as to facilitate the procedures for manual operation in the case ofan error of handling, it is recommended to manually index in certaincases the administration sections—corrector, by a numeral of order, fromcopy No. 1 to the last copy (the author section having been detached andthe copies mixed so that the manual index will have no relationship tothe first code A).

This method juxtaposes the encrypted code and an index to facilitatemanagement, this juxtaposition being carried out automatically by theindexing machine shown in FIGS. 12 to 15, step 1765.

Each copy of the test is thus identified by a second code, with a randomnumber relative to the distribution of the first codes or candidatenumerals, numerals comprised between two limits: for example between No.1250081 and No. 1252080. This series and its correspondence with thecandidate numbers are available in a secured file in the position of theperson responsible for the examinations. This series cannot becontinuous to the origin, but it will necessarily be discontinuous atthe arrival, because the quantity of sheets to be provided is greaterthan the number of inscriptions (for various incidents) and a fortioriof those present.

Correction takes place according to the usual methods, the correctorhaving to conform to the rule for possible annotations, step 1775. Theproblem which arises is that of the relationship of the result of theprocessing by the analysis or analyses or correctors. In the case of anexamination, the result is present in the form of a grade or points.Several analysts or correctors can work on all the copies or on apartial physical aspect: second portion for example, or qualitatively:editorial quality.

The process according to the present invention permits several modes ofreporting the results appropriate to the correction modalities which itpermits in an original manner, step 1780. The reporting mode isaccording to the nature of the second code.

The report of the result with the detachable form by a first corrector,shown in FIG. 3, permits as desired the use of a second code B that ismasked or unmasked. The grade attributed by the first corrector isreported on a first corrector section by the first corrector, this firstcorrector section is detached by the first corrector, then, aftercounting the number of first corrector sections, the latter are sealedin a special “first corrector” envelope, with identification of the lot:test, date, hour, name of the corrector, number of forms from No. X toNo. Y.

The second grade is reported on a second corrective section by thesecond corrector, this second corrective section is detached by thesecond corrector then, after counting the number of second correctivesections, the latter are sealed in a special “second corrector”envelope, with identification of the lot: test, date, time, name ofcorrector, number of forms from No. X to No. Y.

A list and a report can be provided subsidiarily, permitting eachcorrector to confirm his grade and to establish a brief account percopy.

In the case of a report of the result on a list and correction report,this list can constitute a variant to the corrective sections. In thiscase, the administrative section of the anonymity Form 300 does notcontain a corrective section but only an administrative stub. The listof corrections is established in the following manner:

-   -   1) in the case of use of a second masked code B, the        administration know a priori the codes which are distributed in        a test and unmasked after the test, without knowing their        attribution to the authors because the latter are seated        randomly at the beginning of the test. It thus suffices to set        up by computer and preliminarily to the test a list with these        second codes in order. The corrector having copies with the stub        carrying the second code B unmasked, reports the grade on this        stub and for copies of which he has the second code, on the list        of notation for report of grades 700 shown in FIG. 7. The lines        of the second codes of the copies or anonymity forms that are        not distributed or exchanged remain empty. The corrector makes        sure that there are as many grades as copies because he must do        this within the conventional correction procedure. List 700        provided to be read by scanner necessarily comprises second        codes B provided with the distribution. The number of anonymous        forms distributed and hence of second codes B, is necessarily        greater than the number of corrected copies because there are        supplemental forms provided for accidents or for absent persons.        For each copy, the list 700 comprises a copy code 710, zones of        handwritten inscription of grades 720, a bar graph 730 to be        completed to represent the corresponding grade, a region for        comment 740 and a title region 750 in which is indicated the        test in question.    -   2) in the case of the use of a second unmasked code B, the        second code B is legible without a recognition system. The        administrative stubs of the copies of each test are manually        numbered from 1 to X (number of persons present). A section        comprising the second code B and this order number is detached        then read by a scanner, to produce an intermediate file placing        in correspondence the second codes and indices. This enumeration        can be carried out automatically by a machine shown in FIGS. 12        to 15, printing or labeling from 1 to X (number of persons        present) each copy after reading the second code B by producing        a reconciliation file. If the second code B is a barcode, a        unique computer reading of the stubs of the lot can also        generate automatically a computer file with printing of the list        after deposit of the copies at the end of the examination. In        this case, the list comprises only copies distributed to each        corrector. The correspondence file between the second codes and        the indices is carried out for the test and, as the case may be,        per corrector or group of correctors. The corrector reports on        the notation list to report grades 800 shown in FIG. 8, in the        order of printed enumeration, the grade obtained. This        modification is appropriate in the case of multiple corrections.        A process of reconciliation is thus necessary (see the above).        The notation list 800 comprises a title zone 850, which        indicates the test in question, and for each copy, an index 810,        of the zones 820, for handwritten inscription of the grade given        the copy, a bar graph 830 on which the corrector can indicate        graphically the given grade and a zone 840 for comments.

In the case of a report of the result with manual computer directretrieval of the grade written on the stub, the corrector reports theresult on the administrative stub. There are then acquired, by keyboard,the grades carried on the stubs, the acquisition of the grades takingplace by attributing them to a number and not by the name of thecandidate (which avoids any error in acquiring or any “intervention”between acquisition and the end of anonymity, which operation takesseveral days in a university).

The process according to the invention requires only one person andseveral seconds to end the anonymity and to pass in a secured manner theresulting file, step 785. According to the type of second code B, maskedor not, the operation is different:

-   -   in the case of a report of the result with direct acquisition of        the grade carried on the stub with the second masked code B, the        acquisition is simple. The computer list of the unmasked codes        is displayed by software of the spreadsheet or database type,        the acquisition of the grades takes place on this base;    -   in the case of a report of the result with direct acquisition of        the grade carried on the stub with a second unmasked code, if        the result is unique or multiple without negatively judged        interference between the correctors, the acquisition is carried        out by one or two operators.

-   if the second code B is a barcode printed on the stub, the second    code is decrypted by a handheld reader of barcodes, the reading of    the second code in the form of barcodes can trigger the search for    the second code in the list, and the acquisition of each grade is    simple and is carried out by a unique person,

-   if the second code B is an alphanumeric grid code or a graphical    grid code (see above), the reading is carried out by means of a    reading mask and the acquisition of each grade is manually or    automatically performed as a function of recognition of the position    of each element of the second code in the grid.

The operations of “creating” anonymity and ending the anonymity involvean assembly of operations of successive disassociation and association.

-   -   1. Association, during production of the anonymity Form 300,        step 1701, of the first code A and of the second code B, with        creation of a secured correspondence file between these codes.        This correspondence file is divided by commodity and by safety        into lots of a definite number, for example into lots of 50        forms, the 50 numbers of the first organized code A        corresponding to 50 numbers of the second code B. The division        into lots is carried out from an assembly of anonymous Forms        300, for example ten thousand, corresponding to a unique system        of concordance of the first and second codes. An algorithm for        numbering from a random database connects the codes by using        suitable numbering within the limits of 128 bits legally        permitted.    -   2. Definition of a test and of the quality of anonymous Forms        300 that is necessary. Each test will have attributed a number        of lots of Forms 300 permitting distributing at least one Form        300 per participant, these logs belonging to the same assembly.    -   3. After distribution of the anonymous Forms 300, the author        section carrying the first code A is instructed by the        candidate, step 1717: handwritten identification, name, given        name, birth date, . . . or identification by a code belonging to        the candidate, in the form of codes according to the invention        set forth in patent application FR 95 10 803 and shown in FIGS.        6 and 16, or provided with boxes to be checked off shown in        FIGS. 6 and 16. The administrative section carrying the second        code B is left blank by the candidate.    -   4. At the end of the test, if the Form 300 is not integrated to        the copy, it is associated with it, for example by gluing or        stapling. After counting the copies and verification of the        correspondence with the number of those present, the        administration proceeds to detaching from the author stub        carrying the first code A, on the one hand, the physical        element, here the copy, associated or integrated with each        administrative section carrying the second code B, and, if        desired, the stub carrying the second code B, the second code B        being masked or encrypted.

This phase of detachment of the portions, step 1740, requires theabsolute adherence to standards of security for anonymity: integrity ofthe mask, absence of unexpected reading with uncrypting means of thesecond code B.

-   -   1. The unmasking of the second code B or its decryption, is not        necessarily carried out after detachment of the author stub and        before correction of the copy. A second explicit code B        facilitates the management of the data but the latter can be        perfectly well carried out with a masked or non-decrypted code.    -   2. The distribution of the copies to the correctors,        corrections, analysis and association of one or several results        (in the form of a value or grade) to a physical element, here a        copy, step 1775. The process according to the present invention        covers an assembly of possibilities of reports of results:        unique, multiple, independent, overall or partial, step 1780.

The association of results with a copy can take place in different ways.The simplest consists in carrying on the anonymity Form 300, or on asection detachable from this Form 300, the result according to anestablished procedure, in a form legible by scanner, in its principle ina handwritten form, of codes described in patent application FR 95 10803, FIG. 16, 1640, 1650, 1660, of scales or groups of boxes to bechecked off. The second way consists in associating with the differentcopies one or several predefined lists of results whose number ofresults corresponds to the number of anonymous Forms 300 contained inthe lots of copies attributed to the test. The first code A carried bythese lists can take different forms. As the case may be, it isconstituted:

-   -   1. by the second code B, if it is unmasked,    -   2. by a supplemental index carried, either manually or on        anonymity Forms 300 (second code B remaining masked or second        code B encrypted), either automatically (second code B        encrypted) with the construction of a file establishing the        correspondence between the second codes B and the indices (see        the above system of automatic indexing).

The lists, made up before the test, comprise a number of possibilitiesof results equal to the number of anonymity Forms 300 provided for thetest, indexed from 1 to X (number of forms provided).

-   -   1. Sorting out the results and placing these results in the form        of a digital computer file. According to the reporting process        selected, the results will be the object either of direct        computer acquisition or a reading of the different sections of        the anonymity Forms 300, or a reading of the lists of results.        As the case may be, each copy will be the object of one or        several results of different nature, which could be the object        of the desired computer processing: addition, comparison,        processing warnings, averages, statistics of all types.

At this point all the data remain completely anonymous.

-   -   2. Ending anonymity. This could take place for everyone involved        or only for a portion of the latter, for all the results, for a        portion of the results or for a unique result, these results        being adapted to be the object of intermediate processing.

If the association of the results with the second codes B was the objectof complementary indexing, one proceeds by means of the correspondencefile between the second codes B and the indices, to the association ofthese latter to the second codes B.

Finally, under the monitoring of the person responsible who has accessto the secured file of correspondence between the first codes A and thesecond codes B of the lots in question for the test, is carried out thepartial or total matching between the identities of the participants andtheir results or grades, step 1785.

This system can be adapted to any form of monitoring permittinggeneralizing the automation of the management of the pedagogical datawhilst using acquisition means by scanner: monitoring by multiple choicequestionnaire (M.C.Q.), oral monitoring:

-   -   Monitoring by M.C.Q. uses an M.C.Q. form, such as shown in        FIG. 9. In this case, the Form 900 is comprised by an author        section 910, and an administrative section 920, filled in        directly by the candidate. The code B or second code can be        encrypted or masked by a simple label of the type shown in FIG.        19    -   In the case of oral monitoring, the grading forms are        established. In this case, obviously, there is no anonymity, but        there is automatic acquisition of the instructing grading forms.

For a complete management of anonymity according to our process, it isthus necessary to carry out the following operations, certain ones ofwhich are optional:

1) Production of inscription forms shown in FIG. 1, reading the formswith software having motors for reading by scanner of handwrittenmaterial (Optical Character Reading, or OCR), of printed characters,standard barcodes or codes described in patent application FR 95 10 803,of encrypted codes showing FIGS. 10 and 11, of check boxes and graphicalscales (this phase is optional).

2) Production of lists of those present shown in FIG. 2, by reference tothe list of inscriptions per test, with if desired distribution per room(this phase is optional).

3) Production of anonymity forms 300, with the creation of a securedcomputer file for correspondence between the first codes A and thesecond codes B.

4) Production of lists of grading shown in FIGS. 7 and 8, if theanonymity form does not comprise the corrective section, or productionof a form for reporting corrections, each of these forms being destinedfor a predetermined corrector before the examination (this phase isoptional).

All the operations can be carried out well in advance of the test,without “bottleneck”, because the emplacement of these elements can bepredetermined and carried out before the examination. Only the printingis preferably carried out in the weeks preceding the examination withextremely simple modern processes. The production of the copiesthemselves can be carried out independently of the anonymity forms, theycan be made industrially and stored.

Operation of Management of Reading:

At the end of the first test, the signed forms of those present shown inFIG. 2 are given to a computer service which reads them automaticallyand establishes a first file per test. The author sections shown inFIGS. 4, 5 and 6 are read immediately so as to monitor the signing andto determine the values of the first codes A of the candidates present,so as to permit ultimately the end of anonymity of the results.

This system permits in advance the arrangement of the result ofpre-managing the end of anonymity. Thus before the beginning of thecorrections, without using extraordinary means, the system is ready toacquire the grades and to end anonymity automatically.

In the course of a step 1783, the author sections are read to associatean identification of the candidate with each first code and thisassociation is memorized.

Then, to the extent the correctors complete their corrective sections ortheir overall grading forms, these latter are read, the gradesattributed and the results immediately available after the finalreading, and the anonymity can be automatically ended under themonitoring of a unique person responsible having the anonymity-endingfile, step 1785, by means of the first and second codes, and matchingthe identification of the candidate with each grade given him.

This system permits instantaneously having a pre-planned jury report, ifthere is a preliminary definition of the coefficient of each grade andattribution of the different tests to a jury. The statistical resultsare immediately available so as to permit the jury to define itseventual pass rate. Moreover, the assembly of the grades per collectorbeing adapted to be compared between correctors, the possibilities ofadjustment between correctors can be decided according to the criteriaof the jury. Without requiring any supplemental operation, the proposedsystem renders completely anonymous a test with a rapidity and areliability of execution that is total and without precedent.

This permits the assembly of the agents, particularly the instructors,to devote themselves entirely to their pedagogical and evaluative tasks,by freeing them from burdensome administrative operations.

In the case of unmasked second codes B, these latter must remain unknownto the candidates so that they cannot communicate it to the correctorsor the correctors cannot easily recognize this code. A contrary needarises from the fact that the management of the administrative sectionsmust be able to be ensured easily by being able to refer to a legibleand editable code. The use of a barcode easily decryptable by a portablereading wand is possible but has because of this fact problems ofsecurity that arise and are resolved by others. To avoid any possibilityof decryption, two variants of coding system, alphanumerical orgraphical, are proposed.

FIG. 10 shows the principle of the alphanumerical grid codes 1000. Thefirst code A is associated with a second masked or encrypted code B.This encrypted code B is thus identical to the masked B but is notdirectly visually readable. To permit direct reading and by scanner, theformat of the code is given in alphanumeric symbols, digits and theusual letters, but these symbols are “embedded” in an assembly of otheralphanumeric symbols, as shown in FIG. 10. The code is integrated into agrid of alphanumeric symbols 1000 (a unique digit or a unique letter percase), all the elements which do not belong to the second code B beingsubject to random variation. The elements of the code have a fixed place1010 in the grid, so as to permit:

-   -   a direct easy reading of the second code by means of a specific        mask 1020 having indexed holes for each element of the code,        this mask is specific to an assembly of anonymity forms and is        confided to a responsible person.    -   a reading by scanner of the unique boxes of the grid        corresponding to the second code.

In the case of reading by scanner, at least one of the alphanumericvalues which does not belong to the second code can form a part of amonitoring code of the value of the second code B that is read. In thecase of graphic grid codes 1100 that are encrypted, shown in FIG. 11,the second encrypted code B is always identical to the code B but thecode is not present in the form of the usual digits and letters, but onthe contrary, is in the form of graphical signs embedded in an assemblyof other graphical signs, a unique type or several types being adaptedto be used conjointly, a unique being “valid”. The second code B isintegrated into a grid of graphical signs 1100 having, moreover at themost, a unique graphical sign per case, that can vary randomly for eachcase except for the values of the zones reserved for the representationof the second code B. The values representing the second code B arelocated in predetermined zones 1110 of the grid so as to permit:

-   -   an easy direct reading of the second code by means of a specific        mask 1120 having indexed holes for each element of the code,        this mask is specific to assembly of anonymity forms and is        confided to a responsible person.    -   a reading by scanner of the unique zones of the grid        corresponding to the code. In the case of reading by scanner,        the graphical zones contained in at least one of the distraction        zones (which is to say not belonging to the code) can represent        a monitoring code of the value of the second code B.

We have set forth the principles of use of two codes to manage anassembly of complex and different cases of anonymity. As we have seen,the independence of these two codes permits management without fault ofthe anonymity data so that the participants—candidates or certain otherinvolved persons, cannot know the code B of one or several forms byassociating it to the code A. In the absence of masking of the code B,the use of a code B in the form of an encrypted code is a solution whichcreates, for conventional barcodes, a problem of relative reliabilitybecause it is possible to read these codes, after running their coding,or with a portable reading wand for the more complex codes (interlaced).This is why it may be useful to use a series of supplemental codes torender more complex any “pirate” ending of anonymity.

This method can be used in the management of unmasked second codes B inthe form of barcodes with the use or not of lists of results. In thismethod, the second unmasked code B, having the form of a barcode (or anyother type) on the form, is read, recorded in a file and associated inthis file with a simple alphanumeric code, then on the administrationsection of the anonymity form, the code or codes are replaced by one orseveral labels on which a simple alphanumeric code, identical for eachform, is printed. The label system can be replaced by printing ofmasking of the second code B on the form with printing to the side ofthe simple alphanumeric code associated by computer.

These operations can be carried out automatically by an automaticindexing system of the copies or forms described above with regard toFIGS. 12 to 15. As we have seen in the preceding developments, it may beuseful to have a simple coding system to manage the anonymous data:copies of the result or results associated with them. Moreover, thesecond codes B may be indecipherable before separation of the authorsection, to ensure perfect anonymity. The association of a third simplealphanumeric supplemental code C, with each encrypted second code B, isan elegant solution but which can take up more time and thus be costly.The present invention provides a machine permitting attributing asupplemental code or a simple alphanumeric index, to anonymity formsassociated with documents or physical elements.

FIGS. 12 and 13 show a machine for automatic indexing or re-indexing.This type of machine is adapted to read a code on a document or aphysical element. The machine 1200 is comprised:

-   -   by a reading module 1201, composed by an infrared reading head        for standard barcodes or a reading module or CCD camera for any        other type of reading interpreted by computer and by motors for        reading handwritten entries, printing, standard barcodes or for        reading by scanner encrypted codes in boxes to be checked and        graphical scales,    -   by a direct printing module or pneumatic label application 1303        with a module 1202 for printing labels,    -   by a monitoring module 1205, comprised by a reading head or CCD        camera for reading interpreted by computer and by motors for        reading printed entries, of barcodes with explicit reading (with        indication of their value according to ASCII characters), and    -   by a compartmented traveling tape 1306 with the format of copies        1305 which drives these.

The reading module 1201 carries out the reading of the second code B.The reading of the code triggers a computer management by computerconnection 1203 with a computer 1204, which defines an association withan explicit ordered code (of the first copy of the latter and in order),this explicit code is immediately printed, directly or on a labelsecured to a precise position on the copy.

The monitoring module 1205 comprised by a reading head or CCD camera forinterpreted reading by computer and by motors for printed reading ofwriting, of barcodes with explicit reading (with the indication of theirvalue in ASCII characters) permits monitoring the good printing of theexplicit code and its conformity with the predefined series. The indexedor re-indexed copies are then placed by ordered lots in a receptacle1206.

The explicit code can be printed on the form after printing of themasking of the first code or on an inseparable secured label so as toprevent recognition of the first code. In this case, as a modification,a first code A is repeated on the administrative section, theassociation with a supplemental code which identifies it to the secondcode B, the association being carried out during re-indexing, by themachine of FIG. 12 to 14.

In a machine 1400 to index or re-index semi-automatically, shown inFIGS. 14 and 15, the copy 1403 is introduced manually and a corrector1404 triggers a reading module 1401, comprised by an infrared readinghead of standard barcodes or by a reading module or CCD camera, for alltypes of computer interpreted reading and by motors for reading printedwriting, of standard barcodes or with scanner reading, of encryptedcodes shown in FIGS. 10 and 11, of check boxes and of graphical scales.A computer management by a computer connection with a computer definesan association between the code that is read and an ordered explicitcode. Under the influence of pressure, the copy 1403 encounters, at theend of its path, two detectors 1405, placed in series so as to ensureperfect positioning of the copies. These detectors 1405 trigger theprinting of an explicit complementary code, directly or on a grid label,by a printing module 1402 and a positioning of the complementary codeexplicit to a precise position on the copy 1403. In this version,monitoring is carried out visually.

1. Process for anonymous and computerized processing of a document or aphysical element, hereinafter called “physical element”, whose author orproprietor, hereafter called “author”, must remain unknown duringprocessing of the physical element (1775), this processing beingcharacterized in that it comprises: a step (1716) of association orintegration with the physical element of a unique information support(300, 900), comprising: an identification section for the author calledauthor section bearing a first predetermined code, at least oneso-called “administrative” section each bearing a second predeterminedcode identical to or different from the first predetermined code, thesesections forming a unique couple, the codes being previously defined inthe step of association or integration, a step of permanent associationof an identification of the author with the author section (1717); astep of separation of the author section from the physical element(1740), each administrative section remaining attached to or integralwith the physical element; a step of processing the material elementseparated from the author section (1775), to provide at least one resultof processing the physical element; a step of reading the author section(1783) to read and associate the first code with the identification ofthe author of the physical element; a step of reading at least oneadministration section (1784), to read and associate the second codewith at least a result of processing of the physical element; a step ofplacing in correspondence by means of codes, at least one result ofprocessing with the identification of the author of the physicalelement, permitting ending anonymity (1785); at least one of the readingsteps comprising a phase of optoelectronic reading and recognition. 2.Process according to claim 1, characterized in that the first code isunique and different from each second also unique code.
 3. Processaccording to claim 2, characterized in that the relationship between thefirst code and each second code is generated by an unpredictablecomputer algorithm which is a random variable and in that the value ofsaid variable and/or a table of correspondence of codes is memorized. 4.Process according to claim 2, characterized in that the relationshipbetween the first code and each second code is generated by anunpredictable computer algorithm which uses a variable representative ofa type of content of the physical element and in that the value of saidvariable and/or a table of correspondence of the codes is memorized. 5.Process according to claim 1, characterized in that at least oneadministration section constitutes the physical element.
 6. Processaccording to claim 1, characterized in that, in the course of theprocessing step, the information carried by the author on theadministration section is processed and there is furnished at least oneresult in the form of at least one value or grade.
 7. Process accordingto claim 1, characterized in that the unique information supportcomprises an identification stub comprising one of the codes, said stubremaining connected to the physical element of durable material. 8.Process according to claim 1, characterized in that it comprises a stepof inscription of at least one result of the processing step on at leastone administration section and one step of separation of at least oneadministration section from the physical element, before the step ofreading said administrative section.
 9. Process according to claim 1,characterized in that it comprises a step of reading the identificationof the author conjointly with the step of reading the author section andmemorizing the correspondence between the first code and theidentification of the author.
 10. Process according to claim 1,characterized in that it comprises a step of masking at least one of thecodes at least until the step of separation of the author section. 11.Process according to claim 1, characterized in that it comprises a stepof masking by a unique masking element of at least one code at leastuntil the step of separation of the author section.
 12. Processaccording to claim 1, characterized in that it comprises a step ofreading (1784) at least one result of processing conjointly with thestep of reading each administration section.
 13. Process according toclaim 1, characterized in that the unique information support comprisesseveral administration sections bearing the same unique second code anda supplemental code defining the number of the section.
 14. Processaccording to claim 1, characterized in that in the course of the step ofpermanent association of an identification of the author to the authorsection, the identification of the participant is carried out byhandwriting or by a modifiable code in a handwritten manner or in theform of a group of boxes to be checked with alphanumeric value. 15.Process according to claim 1, characterized in that at least one of thecodes is integrated into a grid of alphanumeric values comprising atleast one alphanumeric symbol per box, the elements of the code having apredetermined place in the grid.
 16. Process according to claim 1,characterized in that at least one of the codes corresponds to graphicalsymbols integrated into a grid of graphical symbols whose elementscorresponding to the code have a predetermined place in the grid. 17.Process according to claim 15, characterized in that at least one of theboxes which does not correspond to the code comprises a supplementalcode for monitoring the value of the code in the form of alphanumericvalues or graphic signs, in that each box which comprises thesupplemental code is read and in that the code is monitored as afunction of the content of said boxes.
 18. Process according to claim 1,characterized in that it comprises an intermediate and supplementalchanging of the codes comprising: a step of reading by optoelectronicprocess of an identification and/or of an unmasked code associated withthe identified physical element; a step of recording the identificationor the code in a computer file; a step of placing in correspondence thisidentification and/or this code with an explicit and sequential indexcode adapted to be read and interpreted visually; a step of printing ofthis index code in the course of which the identification and/or thepreviously read code on the physical element is masked, by gluing alabel for example; the physical elements being thus indexed in ananonymous manner, the identification and/or the code read and masked andthe corresponding index code being associated in a memorized file. 19.Process according to claim 1, characterized in that at least one of thesecond codes is not masked during a step of distribution to the authorsof the unique information supports associated with the physicalelements, and is in the form of encrypted codes readable by scanner orby a barcode reading wand.
 20. Process according to claim 1,characterized in that at least one result of the step of processing isreported on at least one list comprising a series of codesrepresentative of second codes, the step of placing in correspondencebeing then carried out by optoelectronic reading of said list or bymanual acquisition of the results in a computer file comprising saidlist.
 21. Process according to claim 1, characterized in that eachsecond code is not masked and is in the form of encrypted codes, or ofgraphic grill codes with optoelectronic reading.
 22. Process accordingto claim 1, characterized in that each second code is masked during astep of distribution to the authors of the unique information supportsassociated with the physical elements, and is identical to the firstcode, the first code being in the form of encrypted code, or in the formof code corresponding to graphic signs integrated into a grid of graphicsigns whose elements corresponding to the code have a predeterminedplace in the grid, or in the form of a code integrated into the grid ofalphanumeric values comprising at least one alphanumeric symbol per box,the elements of the code having a predetermined place in the grid. 23.Machine to re-index the elements identified by codes, using the processaccording to claim 1, characterized in that it comprises: a readingdevice by optoelectronic process of a written identification or of acode, carried by the physical element or on the unique informationsupport; a computer device for recordation of the written identificationor of the code read in a digital file and which associates in saiddigital file an explicit and sequential index code adapted to be readand interpreted visually; a device for printing this index code; asystem for masking the written identification or the code read on eachphysical element, such that each physical element is thus re-indexed inan anonymous manner and is adapted to be visually interpreted.
 24. Formfor anonymous processing of a physical element, characterized in that itcomprises: an author section associated with a first code and adapted toreceive an identification of the author of the physical element; atleast one second administrative section associated with a second codeidentical to or different from the first code; these sections beingconnected to form a unique couple, the codes being either identical andspecific for each form, or different and corresponding for each form inan unpredictable manner, the form being adapted to be secured to thephysical element, the author section being provided to be detached fromthe administrative section, the administration section remainingassociated with the physical element.
 25. Form according to claim 24,characterized in that it comprises moreover a stub carrying first and/orsecond codes, said stub being associated permanently with the physicalelement.
 26. Form according to claim 24, characterized in that itcomprises at least one administrative section associated with the secondcode and/or with a complementary code representative of the second code,the complementary code being adapted to be different for eachadministrative section.
 27. Form according to claim 24, characterized inthat it comprises a mask adapted to mask at least one code.
 28. Formaccording to claim 24, characterized in that at least one administrativesection is adapted to receive at least one result of processing of thephysical element, in the form of at least one value or grade.
 29. Formaccording to claim 24, characterized in that at least one administrativesection is adapted to be directly filled in by the author: for example,a questionnaire, a multiple choice questionnaire.
 30. Label for maskingcode used in the process according to claim 1, characterized in that itis opaque and comprises a pre-cutout of an internal zone which duringseparation of the sections is detached and leaves visible at least onecode previously imprinted on at least one of the sections.